Product

external-secrets github.com/external-secrets/external-secrets/apis vulnerabilities

1 published CVE affecting external-secrets github.com/external-secrets/external-secrets/apis, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 1
Critical: 0
High: 0
Medium: 1
Low: 0
Unscored: 0
CISA KEV: 0

Latest external-secrets github.com/external-secrets/external-secrets/apis CVEs

Newest publication first

CVE-2026-42876 External Secrets Operator: Privilege escalation with secret overwriting
Published 2026-05-11

MediumCVSS 4.9 EPSS 0.22%

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Prior to 2.4.1, a user who only has permission to create ExternalSecret resources can cause the operator to create a Secret that Kubernetes will auto...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.

external-secrets github.com/external-secrets/external-secrets/apis vulnerabilities

Latest external-secrets github.com/external-secrets/external-secrets/apis CVEs

CVE-2026-42876 External Secrets Operator: Privilege escalation with secret overwriting